Bug 2369476 (CVE-2025-48943) - CVE-2025-48943 vllm: Remote crash of vllm server with invalid regex
Summary: CVE-2025-48943 vllm: Remote crash of vllm server with invalid regex
Keywords:
Status: NEW
Alias: CVE-2025-48943
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-30 19:01 UTC by OSIDB Bzimport
Modified: 2025-06-03 15:58 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-05-30 19:01:12 UTC 
vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.
Note You need to log in before you can comment on or make changes to this bug.